Skip to content

Commit bcd8b92

Browse files
author
Maceo Thompson
committed
testdata: Add more package/mod level tests
Adds package level json tests as well as text output testing fro module and package level scans. Change-Id: Idad6ae2214c752fef5750963e1a6c36de7717a97 Reviewed-on: https://go-review.googlesource.com/c/vuln/+/545639 Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
1 parent 65a3641 commit bcd8b92

File tree

5 files changed

+453
-0
lines changed

5 files changed

+453
-0
lines changed

‎cmd/govulncheck/testdata/testfiles/source-module/source_module_text.ct

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#####
2+
# Testing that govulncheck doesn't mention calls when it doesn't
3+
# have callstack information
4+
$ govulncheck -scan module -C ${moddir}/multientry
5+
Scanning your code across 2 dependent modules for known vulnerabilities...
6+
7+
=== Informational ===
8+
9+
There are 2 vulnerabilities in modules that you require. Use
10+
-scan=symbol with govulncheck for more fine grained vulnerability
11+
detection.
12+
See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck for details.
13+
14+
Vulnerability #1: GO-2022-0969
15+
HTTP/2 server connections can hang forever waiting for a clean shutdown that
16+
was preempted by a fatal error. This condition can be exploited by a
17+
malicious client to cause a denial of service.
18+
More info: https://pkg.go.dev/vuln/GO-2022-0969
19+
Standard library
20+
Found in: net/http@go1.18
21+
Fixed in: net/http@go1.18.6
22+
23+
Vulnerability #2: GO-2021-0113
24+
Due to improper index calculation, an incorrectly formatted language tag can
25+
cause Parse to panic via an out of bounds read. If Parse is used to process
26+
untrusted user inputs, this may be used as a vector for a denial of service
27+
attack.
28+
More info: https://pkg.go.dev/vuln/GO-2021-0113
29+
Module: golang.org/x/text
30+
Found in: golang.org/x/text@v0.3.5
31+
Fixed in: golang.org/x/text@v0.3.7
32+
33+
34+
Share feedback at https://go.dev/s/govulncheck-feedback.

‎cmd/govulncheck/testdata/testfiles/source-package/package_short_curcuits.ct

Lines changed: 310 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,310 @@
1+
#####
2+
# Test that findings with callstacks are not emitted in package mode
3+
$ govulncheck -json -scan package -C ${moddir}/multientry .
4+
{
5+
"config": {
6+
"protocol_version": "v1.0.0",
7+
"scanner_name": "govulncheck",
8+
"scanner_version": "v0.0.0-00000000000-20000101010101",
9+
"db": "testdata/vulndb-v1",
10+
"db_last_modified": "2023-04-03T15:57:51Z",
11+
"go_version": "go1.18",
12+
"scan_level": "package"
13+
}
14+
}
15+
{
16+
"progress": {
17+
"message": "Scanning your code and P packages across M dependent modules for known vulnerabilities..."
18+
}
19+
}
20+
{
21+
"osv": {
22+
"schema_version": "1.3.1",
23+
"id": "GO-2022-0969",
24+
"modified": "2023-04-03T15:57:51Z",
25+
"published": "2022-09-12T20:23:06Z",
26+
"aliases": [
27+
"CVE-2022-27664",
28+
"GHSA-69cg-p879-7622"
29+
],
30+
"details": "HTTP/2 server connections can hang forever waiting for a clean shutdown that was preempted by a fatal error. This condition can be exploited by a malicious client to cause a denial of service.",
31+
"affected": [
32+
{
33+
"package": {
34+
"name": "stdlib",
35+
"ecosystem": "Go"
36+
},
37+
"ranges": [
38+
{
39+
"type": "SEMVER",
40+
"events": [
41+
{
42+
"introduced": "0"
43+
},
44+
{
45+
"fixed": "1.18.6"
46+
},
47+
{
48+
"introduced": "1.19.0"
49+
},
50+
{
51+
"fixed": "1.19.1"
52+
}
53+
]
54+
}
55+
],
56+
"ecosystem_specific": {
57+
"imports": [
58+
{
59+
"path": "net/http",
60+
"symbols": [
61+
"ListenAndServe",
62+
"ListenAndServeTLS",
63+
"Serve",
64+
"ServeTLS",
65+
"Server.ListenAndServe",
66+
"Server.ListenAndServeTLS",
67+
"Server.Serve",
68+
"Server.ServeTLS",
69+
"http2Server.ServeConn",
70+
"http2serverConn.goAway"
71+
]
72+
}
73+
]
74+
}
75+
},
76+
{
77+
"package": {
78+
"name": "golang.org/x/net",
79+
"ecosystem": "Go"
80+
},
81+
"ranges": [
82+
{
83+
"type": "SEMVER",
84+
"events": [
85+
{
86+
"introduced": "0"
87+
},
88+
{
89+
"fixed": "0.0.0-20220906165146-f3363e06e74c"
90+
}
91+
]
92+
}
93+
],
94+
"ecosystem_specific": {
95+
"imports": [
96+
{
97+
"path": "golang.org/x/net/http2",
98+
"symbols": [
99+
"Server.ServeConn",
100+
"serverConn.goAway"
101+
]
102+
}
103+
]
104+
}
105+
}
106+
],
107+
"references": [
108+
{
109+
"type": "WEB",
110+
"url": "https://groups.google.com/g/golang-announce/c/x49AQzIVX-s"
111+
},
112+
{
113+
"type": "REPORT",
114+
"url": "https://go.dev/issue/54658"
115+
},
116+
{
117+
"type": "FIX",
118+
"url": "https://go.dev/cl/428735"
119+
}
120+
],
121+
"credits": [
122+
{
123+
"name": "Bahruz Jabiyev, Tommaso Innocenti, Anthony Gavazzi, Steven Sprecher, and Kaan Onarlioglu"
124+
}
125+
],
126+
"database_specific": {
127+
"url": "https://pkg.go.dev/vuln/GO-2022-0969"
128+
}
129+
}
130+
}
131+
{
132+
"finding": {
133+
"osv": "GO-2022-0969",
134+
"fixed_version": "v1.18.6",
135+
"trace": [
136+
{
137+
"module": "stdlib",
138+
"version": "v1.18.0",
139+
"package": "net/http"
140+
}
141+
]
142+
}
143+
}
144+
{
145+
"osv": {
146+
"schema_version": "1.3.1",
147+
"id": "GO-2021-0113",
148+
"modified": "2023-04-03T15:57:51Z",
149+
"published": "2021-10-06T17:51:21Z",
150+
"aliases": [
151+
"CVE-2021-38561",
152+
"GHSA-ppp9-7jff-5vj2"
153+
],
154+
"details": "Due to improper index calculation, an incorrectly formatted language tag can cause Parse to panic via an out of bounds read. If Parse is used to process untrusted user inputs, this may be used as a vector for a denial of service attack.",
155+
"affected": [
156+
{
157+
"package": {
158+
"name": "golang.org/x/text",
159+
"ecosystem": "Go"
160+
},
161+
"ranges": [
162+
{
163+
"type": "SEMVER",
164+
"events": [
165+
{
166+
"introduced": "0"
167+
},
168+
{
169+
"fixed": "0.3.7"
170+
}
171+
]
172+
}
173+
],
174+
"ecosystem_specific": {
175+
"imports": [
176+
{
177+
"path": "golang.org/x/text/language",
178+
"symbols": [
179+
"MatchStrings",
180+
"MustParse",
181+
"Parse",
182+
"ParseAcceptLanguage"
183+
]
184+
}
185+
]
186+
}
187+
}
188+
],
189+
"references": [
190+
{
191+
"type": "FIX",
192+
"url": "https://go.dev/cl/340830"
193+
},
194+
{
195+
"type": "FIX",
196+
"url": "https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f"
197+
}
198+
],
199+
"credits": [
200+
{
201+
"name": "Guido Vranken"
202+
}
203+
],
204+
"database_specific": {
205+
"url": "https://pkg.go.dev/vuln/GO-2021-0113"
206+
}
207+
}
208+
}
209+
{
210+
"finding": {
211+
"osv": "GO-2021-0113",
212+
"fixed_version": "v0.3.7",
213+
"trace": [
214+
{
215+
"module": "golang.org/x/text",
216+
"version": "v0.3.5"
217+
}
218+
]
219+
}
220+
}
221+
{
222+
"finding": {
223+
"osv": "GO-2021-0113",
224+
"fixed_version": "v0.3.7",
225+
"trace": [
226+
{
227+
"module": "golang.org/x/text",
228+
"version": "v0.3.5",
229+
"package": "golang.org/x/text/language"
230+
}
231+
]
232+
}
233+
}
234+
{
235+
"osv": {
236+
"schema_version": "1.3.1",
237+
"id": "GO-2020-0015",
238+
"modified": "2023-04-03T15:57:51Z",
239+
"published": "2021-04-14T20:04:52Z",
240+
"aliases": [
241+
"CVE-2020-14040",
242+
"GHSA-5rcv-m4m3-hfh7"
243+
],
244+
"details": "An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to transform.String. If used to parse user supplied input, this may be used as a denial of service vector.",
245+
"affected": [
246+
{
247+
"package": {
248+
"name": "golang.org/x/text",
249+
"ecosystem": "Go"
250+
},
251+
"ranges": [
252+
{
253+
"type": "SEMVER",
254+
"events": [
255+
{
256+
"introduced": "0"
257+
},
258+
{
259+
"fixed": "0.3.3"
260+
}
261+
]
262+
}
263+
],
264+
"ecosystem_specific": {
265+
"imports": [
266+
{
267+
"path": "golang.org/x/text/encoding/unicode",
268+
"symbols": [
269+
"bomOverride.Transform",
270+
"utf16Decoder.Transform"
271+
]
272+
},
273+
{
274+
"path": "golang.org/x/text/transform",
275+
"symbols": [
276+
"String"
277+
]
278+
}
279+
]
280+
}
281+
}
282+
],
283+
"references": [
284+
{
285+
"type": "FIX",
286+
"url": "https://go.dev/cl/238238"
287+
},
288+
{
289+
"type": "FIX",
290+
"url": "https://go.googlesource.com/text/+/23ae387dee1f90d29a23c0e87ee0b46038fbed0e"
291+
},
292+
{
293+
"type": "REPORT",
294+
"url": "https://go.dev/issue/39491"
295+
},
296+
{
297+
"type": "WEB",
298+
"url": "https://groups.google.com/g/golang-announce/c/bXVeAmGOqz0"
299+
}
300+
],
301+
"credits": [
302+
{
303+
"name": "@abacabadabacaba and Anton Gyllenberg"
304+
}
305+
],
306+
"database_specific": {
307+
"url": "https://pkg.go.dev/vuln/GO-2020-0015"
308+
}
309+
}
310+
}

‎cmd/govulncheck/testdata/testfiles/source-package/source_package_text.ct

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#####
2+
# Testing that govulncheck doesn't mention calls when it doesn't have the relevant info
3+
$ govulncheck -scan package -C ${moddir}/multientry .
4+
Scanning your code and P packages across M dependent modules for known vulnerabilities...
5+
6+
=== Informational ===
7+
8+
Found 1 vulnerability in packages that you import. There is also 1
9+
vulnerability in modules that you require. Use -scan=symbol with
10+
govulncheck for more fine grained vulnerability detection.
11+
See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck for details.
12+
13+
Vulnerability #1: GO-2022-0969
14+
HTTP/2 server connections can hang forever waiting for a clean shutdown that
15+
was preempted by a fatal error. This condition can be exploited by a
16+
malicious client to cause a denial of service.
17+
More info: https://pkg.go.dev/vuln/GO-2022-0969
18+
Standard library
19+
Found in: net/http@go1.18
20+
Fixed in: net/http@go1.18.6
21+
22+
Vulnerability #2: GO-2021-0113
23+
Due to improper index calculation, an incorrectly formatted language tag can
24+
cause Parse to panic via an out of bounds read. If Parse is used to process
25+
untrusted user inputs, this may be used as a vector for a denial of service
26+
attack.
27+
More info: https://pkg.go.dev/vuln/GO-2021-0113
28+
Module: golang.org/x/text
29+
Found in: golang.org/x/text@v0.3.5
30+
Fixed in: golang.org/x/text@v0.3.7
31+
32+
33+
Share feedback at https://go.dev/s/govulncheck-feedback.

0 commit comments

Comments
 (0)